Watchout - Another cryptographic attack that can break encrypted TLS traffic (including 1.3). It's a variation of the original Bleichenbacher oracle attack.

Good news is is that an updated versions of all the affected libraries were published concurrently in November 2018, when researchers published an initial draft of their research paper

The attack leverages a side-channel leak via cache access timings of these implementations in order to break the RSA key exchanges of TLS implementations


The reason for all these attack variations is because the authors of the TLS encryption protocol decided to add countermeasures to make attempts to guess the RSA decryption key harder, instead of replacing the insecure RSA algorithm.


https://www.zdnet.com/article/new-tls-encryption-busting-attack-also-impacts-the-newer-tls-1-3/

Vendor Risk Management - Remember their security practices will affect your security posture. An attacker this week simultaneously encrypted endpoint systems and servers belonging to all customers of a US-based managed service provider by exploiting a vulnerable plugin for a remote monitoring and management tool used by the MSP

The attack resulted in some 1,500 to 2,000 systems belonging to the MSP's clients getting cryptolocked and the MSP itself facing a $2.6 million ransom demand

In this case, the executable was Gandcrab, a widely distributed ransomware tool that has been used in numerous previous attacks. All customer systems that the MSP was managing via the Kaseya RMM tool were encrypted simultaneously, locking users out of them.

Attacks on MSPs are a growing concern. Recently, threat actors, some sponsored by nation states, have begun targeting MSPs in an attempt to get to the networks of their clients.

https://www.darkreading.com/attacks-breaches/ransomware-attack-via-msp-locks-customers-out-of-systems/d/d-id/1333825

If you absolutely have to have Alexa or Google Assistant in your home, heed the following advice:

DO NOT put a digital assistant in a child's room.

1. Change the Default Password on Your Wi-Fi Router
2. Set the Voice Lock
3. Decide Whether You Want to Shop By Voice
4. Understand that Privacy Rights in the US Are on the Way – but Are Not Law Yet
5. Be Smart About Where you Locate Your Devices
6. Be Aware that Smart TVs Come With Digital Assistants


Make sure to set the voice lock for just the adults in the home.

Make sure you receive follow-up emails confirming your purchases, and check your credit card statements to make sure fraudsters aren't running up charges on your account

When the TV gets old and you pass it along to a friend or take it to the dump, find out how to erase all the data. 

https://www.darkreading.com/vulnerabilities---threats/6-security-tips-before-you-put-a-digital-assistant-to-work/d/d-id/1333783

Interesting Security Extension for Google Chrome - Google has released a new add-on for the Chrome browser that automatically and securely checks website credentials against known password breaches.

The Chrome browser extension, called Password Checkup, is available today. It securely checks credentials used to log in to websites—whether they're manually entered or stored in Chrome's password manager—against hashed credentials stored in an encrypted database of billions of compromised accounts maintained by Google.

https://arstechnica.com/information-technology/2019/02/google-releases-chrome-extension-that-alerts-to-breached-passwords/

Another Good news if you are a Firefox user - Firefox 67, which is planned to be released in May 2019, will have a few exciting features

1. Block cryptocurrency miners
2. Block fingerprinting
3. Mute videos autoplaying.

Cryptominers not only use the CPU’s resources to mine for cryptocurrency but also affects the computer’s performance in the long run. The entire system becomes slow and operations get delayed

Fingerprinting is a technique that can create user profiles for tracking purposes using the information that the connecting device, scripts (if permitted), and browser provide.

https://www.hackread.com/firefox-offers-fingerprinting-cryptomining-protection/

Interesting Headline - Japanese government plans to hack into citizens' IoT devices

The Japanese government approved a law amendment on Friday that will allow government workers to hack into people's Internet of Things devices as part of an unprecedented survey of insecure IoT devices.

NICT employees will be allowed to use default passwords and password dictionaries to attempt to log into Japanese consumers' IoT devices.

The plan is to compile a list of insecure devices that use default and easy-to-guess passwords and pass it on to authorities and the relevant internet service providers, so they can take measures to alert consumers and secure the devices.


https://www.zdnet.com/article/japanese-government-plans-to-hack-into-citizens-iot-devices/

Cyber attack against US - Different countries , different intentions (apart from meddling with upcoming 2020 election)

• China, has the capacity and desire to go after American targets for not only diplomatic and military information, but also for attacks on infrastructure and private-sector business.
• Russia, for example, will likely continue to go after critical infrastructure and focus on stealing intel from NATO
• Iran, meanwhile, is likely to focus on social media campaigns to help boost its public image and sway opinions in its favor.
• North Korea will look to boost its coffers with financial hacks. 

https://www.theregister.co.uk/2019/01/30/us_election_meddling/